Microsoft reports a campaign between August 3 and 5, 2026 that sent more than a million emails impersonating company executives to push accounts-payable staff toward an ACH payment of nearly $50,000, backed by fabricated invoices and forwarded threads impersonating ServiceNow. Microsoft says the templates showed multiple indicators consistent with generative AI, though these do not establish how much of the content AI produced.
Why it matters
It shows indicators of generative AI in a high-volume business email compromise campaign, where the losses per successful email can be large.
Key facts
As stated in the sources, with where to find them.
- 87.7% of the emails went to users in the United States.Email delivery
- The actor used multiple third-party email service accounts and registered impersonation domains.Attack chain overview
- Microsoft describes the evidence of AI use as indicators consistent with generative AI in template creation.Introduction
Findings that cite this record
No tracked finding cites this record yet.
Sources
Related records
Sep 25, 2026
Aug 27, 2025
Jan 24, 2024